Firewall Builder 4.0 is currently in beta testing phase. If you find it interesting after reading this post, please download and try it out. Source code archives, binary deb and rpm packages for popular Linux distributions and commercially distributed Windows and Mac OS X packages are available for download here.

In this post I demonstrate how Firewall Builder can be used to generate firewall configuration for a clustered web server with multiple virtual IP addresses. The firewall is running on each web server in the cluster. This example assumes the cluster is built with heartbeat using "old" style configuration files, but which high availability software is used to build the cluster is not really essential. I start with the setup that consists of two identical servers running Linux but in the end of the article I am going to demonstrate how this configuration can be converted to OpenBSD with CARP. In this example I am working with redundant web server configuration where each machine has its own IP address, plus three additional virtual addresses that can be used for virtual hosts. Firewall Builder generates iptables script for both machines. Configuration of the HA agent should be handled either manually or using specialized configuration system such as pacemaker. When I convert the same setup from Linux to OpenBSD, I am going to show how fwbuilder can generate not only firewall configuration, but also the script that manages CARP and pfsync interfaces.

Fig.01: HA configuration using two web servers

Note

IPv6 addresses are not used in this example. Some interface objects in the screen shots have ipv6 addresses because firewall objects were "discovered" using snmp which finds ipv6 addresses. You can disregard these addresses while working with examples in this chapter.

Setting up heartbeat

Note

I am going to use an "old" heartbeat configuration files in this example just to demonstrate how the configuration looks like. You should probably use modern Cluster Resource Manager software such as Pacemaker.

As shown in Figure 1, machines linux-test-1 and linux-test-2 run heartbeat daemon (Linux-HA home page) to create virtual IP addresses. Heartbeat adds virtual IP address to the same interface eth0. One of the daemons becomes master and takes ownership of the virtual address by adding it to the interface with the label "eth0:0" or "eth0:1".

Once heartbeat daemon is configured and started on both servers, their IP address configuration looks like shown in Figure 2 and Figure 3. Virtual addresses were highlighted to illustrate that the heartbeat is running in active/active configuration, that is, two virtual addresses are active on one machine and the third is active on another. If either machine dies, all three virtual addresses will move over to the one that is left working.

It is not 100% open source project. I get it some one need to be get paid for hard work for writing software and all other stuff for your time. IMO, you should not put evaluation mode Windows package. Put full package, if it is good people will send money like Apache project.

You don’t get open source, do you? “Free software” is a matter of liberty, not price. To understand the concept, you should think of “free” as in “free speech,” not as in “free beer.” If you don’t like pre built package download source code from their sourceforge page. Please educate yourself before posting, here is a good starting point for you:http://www.gnu.org/philosophy/free-sw.html

@Vadim, keep it up good work. I do not use your software; I’m just a desktop user. But, ill give it a try, it may come handy if I decided to host my own webserver or something like that.